Start Anyconnect on WebVPN Portal

[strakamar]

I am trying to remove the Start Anyconnect shortcut and any references to Start Anyconnect from the webvpn portal for a customization object I have.

I can disable it from the application section of the vpn customization which solves one issue. But after I connect with a user the default page it loads and in one of the frames has the start anyconnect. Once I select home, Web Applications,  Browse Networks which I have enabled I no longer have access unless of course I logout and then log back in.

Any Assistance in removing the start anyconnect frame showing up in the webvpn interface after a user first logs in would be great.

asdm 6.3

asa5510

Thanks!

[Gustavo Medina]

You could go to the group-policy and disable the SVC protocol!

[strakamar]

This group of users in that policy require both the  client and clientless access. So if I disable the svc protocol for that  policy I assume that the ssl vpn client would stop working. I could create a seperate profile but that would add some complexity for users.

What I would like if possible would be to remove it from the customization object (or the webvpn pages).

Thanks!

[dbgreekas]

Do it with two profiles, you can hid the complexity from the users.

Webvpn users profile can be selected by URL, if you are using the default portal just map the URL to the default profile.

If you are deploying any connect to the users, just embed the Anyconnect profile selection in the configuration profile and any connect will just connect to the profile..

From the users point of view they will not need to know about profiles.

[tgrundbacher · Accepted solution]

Hi

I'm not sure about what exaclty you want to achieve in which order, but maybe this helps: There are two methods that help distinguish and prioritize the use between 'SVC' (AnyConnect client) and 'WebVPN' (the clientless portal):

1. Allowance of the use of SVC or WebVPN as such (per group policy).
2. The options about how the ASA should deal with SVC upon user login into the clientless portal. Available options:

• Select SVC automatically right away -> No dialog shown to the user, the portal homepage will never load.
  
• Propose to use SVC through a portal dialog for a certain amount of seconds, then automatically select OR do NOT select it -> If the user doesn't act upon, the dialog will vanish in the process and the pre-configured SVC action will be taken.
• Do not select or propose to use SVC at all -> Portal homepage will load, no reference to SVC is shown.
  

If you're familiar with the CLI, here are the commands that will help you customizing the methods to your liking (consult the command reference for your deployed OS if you should have any questions):

policy-group
vpn-tunnel-protocol {[IPSec] [l2tp-ipsec] [svc] [webvpn]}
webvpn
  svc ask {none | enable [default {webvpn | svc} [timeout seconds]]}

The default for ASA OS 8.2 is:

   svc ask none default webvpn

(-> Like that, no reference to SVC will be presented and SVC session will NOT be initiated through the clientless portal. Nevertheless, if you configured vpn-tunnel-protocol svc webvpn, the user will still be able to login with the AnyConnect client pre-installed locally on his machine, PARALLEL to being able to log in into the clientless portal.)

Regards

Toni

[strakamar]

I had contacted tac and spoke with a fantastic engineer. The resolution was in the Dynamic Access Policy (DAP). We changed the Access Method to "unchanged" and that removed the "Start Anyconnect" frame from showing up when you first login on the webvpn.

Thanks To All!